Skip to content

EntraChecks v1.6.0 — On-Premises AD + Hybrid Analysis

Choose a tag to compare

View all tags
@NamelessSaint8 NamelessSaint8 released this 04 May 21:05
· 114 commits to main since this release
v1.6.0
a4cce28

Adds on-premises Active Directory as a first-class module, plus the Hybrid Analysis mode that runs cloud + on-prem together and correlates identity-bearing findings across the two planes.

Highlights

Active Directory module (new)

33 read-only AD security checks integrated into the EntraChecks orchestrator. Schema-aligned findings flow into the unified HTML / Excel / CSV reports alongside cloud findings. Graceful degradation when not domain-joined / without RSAT / on non-Windows.

Categories covered:

  • Privileged Access (15 checks) — Domain/Enterprise/Schema Admins, Protected Users, AdminSDHolder drift, dangerous SIDs, OU+GPO delegation, nested group paths, LAPS deployment, DirSync account privilege audit
  • Authentication (7 checks) — password policy, KRBTGT age, Kerberos pre-auth, duplicate SPNs, user SPNs, GPP cpasswords in SYSVOL, Kerberoastable accounts with password-age + RC4 correlation
  • Delegation (2 checks) — unconstrained delegation, constrained overview
  • Account Lifecycle (4 checks) — stale accounts, password never expires, managed service accounts, passwords in Description
  • Infrastructure (5 checks) — forest/domain info, DCs, domain trusts, GPO inventory, DC security settings (LDAP signing, channel binding, SMB signing)

Critical-severity checks: unconstrained delegation, KRBTGT age, AdminSDHolder drift, dangerous SIDs, GPP cpasswords, Kerberoastable (privileged), DirSync account in Domain Admins.

Hybrid Analysis mode (new)

New `[Y] Hybrid Analysis` main-menu item + `-Mode Hybrid` CLI. Runs cloud + hybrid + on-prem in a single invocation and produces a cross-plane principal correlation report highlighting users flagged in BOTH identity planes.

  • Exact matches — UPN-level (Confidence='Exact')
  • Inferred matches — sAMAccountName fallback when UPN-level can't confirm (Confidence='Inferred')
  • New section in unified HTML, new Excel sheet (`Hybrid Correlation`), new CSV file (`13-HybridCorrelation.csv`)
  • Invoke-able as `.\Start-EntraChecks.ps1 -Mode Hybrid -TenantName "Contoso"`

SOC 2 CC6 integration

AD findings carry `SOC2-CC6.1` / `SOC2-CC6.2` in `ComplianceFrameworks` automatically. When SOC 2 readiness is enabled, they flow into the CC6 control-evidence tables in the SOC 2 report without additional configuration.

Upgrading

No action required. All changes are additive:

  • Quick Assessment stays cloud-only (no behavior change for existing workflows).
  • Opt into AD via `[8] Active Directory` menu item, `[Y] Hybrid Analysis`, or CLI `-Modules ActiveDirectory` / `-Mode Hybrid`.
  • Optional `ActiveDirectory` config block added to `config/entrachecks.config.json` — defaults off.
  • `ad/ActiveDirectoryv3.ps1` (the standalone pre-v1.6.0 script) has been removed; its content lives in `Modules/EntraChecks-ActiveDirectory.psm1` now.

Under the hood

  • Modules added: `EntraChecks-ActiveDirectory.psm1` (~1700 lines), `EntraChecks-HybridCorrelation.psm1`
  • Docs added: `docs/ActiveDirectory-Guide.md`, `docs/Hybrid-Analysis-Guide.md`
  • Tests added: `Tests/EntraChecks-ActiveDirectory.Tests.ps1` (24 tests for PR 1, +9 for PR 2), `Tests/EntraChecks-HybridCorrelation.Tests.ps1` (11 tests)
  • Coverage: 44 Pester tests shipped for the AD+Hybrid surface (fixture-driven, no live domain required on CI)
  • Quality: PSScriptAnalyzer 0 warnings across all changed files

Deferred

Planned for future releases but not in v1.6.0:

  • AD CS template vulnerabilities (ESC1-8) — whole-PR effort given the depth of PKI analysis
  • BloodHound-style ACL abuse path enumeration
  • SMBv1 / NetBIOS / LLMNR host enumeration
  • Reversible-encryption audit

Documentation

Assets 2
Loading